#VU47053 Input validation error in UAParser.js - CVE-2020-7733

Vulnerability identifier: #VU47053

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-7733

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
UAParser.js
Web applications / JS libraries

Vendor: Faisal Salman

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.

Mitigation
Install update from vendor's website.

Vulnerable software versions

UAParser.js: 0.7.0 - 0.7.21

---

External links
https://github.com/faisalman/ua-parser-js/commit/233d3bae22a795153a7e6638887ce159c63e557d
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBFAISALMAN-674666
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-674665
https://snyk.io/vuln/SNYK-JS-UAPARSERJS-610226

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.